Users
Manage user accounts, roles, subscriptions, quotas, rate limits, and data retention policies at the individual user level. These endpoints give administrators full control over user lifecycle and per-user configuration overrides.
Base path: /api/v1/admin/users
Endpoints Overview
User Profile Management
User Subscription Management
User Quota Management
User Rate Limit Management
User Data Retention Management
User Profile Management
List Users
GET /api/v1/admin/users
Requires Authentication - Scopes: admin:users:read
Returns a paginated list of all users in the tenant with support for filtering and sorting.
Query Parameters
Parameter
Type
Required
Default
Description
page
integer
No
0
Page number (zero-based).
size
integer
No
20
Page size (max 100).
sort
string
No
name,asc
Sort field and direction (e.g. name,asc, createdAt,desc). Supported fields: name, username, createdAt, lastActivityAt.
search
string
No
-
Case-insensitive partial match on name or username.
role
string
No
-
Filter by role slug. Comma-separated for multiple (e.g. admin,manager).
subscriptionPlan
string
No
-
Filter by subscription plan slug (e.g. pro,free).
subscriptionStatus
string
No
-
Filter by subscription status: ACTIVE, CANCELED.
createdAfter
ISO 8601
No
-
Only users created after this timestamp.
createdBefore
ISO 8601
No
-
Only users created before this timestamp.
Field
Type
Nullable
Description
content
AdminUserResponse[]
No
Array of user items for the current page.
page
integer
No
Current page number (zero-based).
size
integer
No
Number of items on this page.
totalElements
long
No
Total number of matching users.
totalPages
integer
No
Total number of pages.
filters
Filters
No
Applied filter values echoed back.
sort
SortInfo
No
Applied sort field and direction.
Example AdminUserPageResponse {
"content" : [
{
"id" : "a1b2c3d4-e5f6-7890-abcd-ef1234567890" ,
"username" : "john.doe" ,
"name" : "John Doe" ,
"role" : {
"id" : "f47ac10b-58cc-4372-a567-0e02b2c3d479" ,
"name" : "User" ,
"slug" : "user" ,
"type" : "SYSTEM"
},
"subscription" : {
"planSlug" : "pro" ,
"planName" : "Professional" ,
"status" : "ACTIVE" ,
"currentPeriodEnd" : "2026-05-01T00:00:00Z"
},
"enabled" : true ,
"createdAt" : "2026-01-15T10:30:00Z" ,
"lastActivityAt" : "2026-04-07T14:22:00Z"
}
],
"page" : 0 ,
"size" : 1 ,
"totalElements" : 1 ,
"totalPages" : 1 ,
"filters" : {
"search" : "john" ,
"role" : null ,
"subscriptionPlan" : null ,
"subscriptionStatus" : null ,
"createdAfter" : null ,
"createdBefore" : null
},
"sort" : {
"field" : "name" ,
"direction" : "asc"
}
}
Status
Description
200 OK
Users retrieved successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
Get User by ID
GET /api/v1/admin/users/{userId}
Requires Authentication - Scopes: admin:users:read
Returns the full profile for a single user including role assignment metadata and subscription details.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
AdminUserDetailResponse
Field
Type
Nullable
Description
id
UUID
No
User unique identifier.
username
string
No
Login username.
name
string
No
Display name.
additionalInfo
string
Yes
Admin notes or extra information.
role
AdminUserRoleDetailSummary
No
Assigned role with assignment metadata.
subscription
AdminUserSubscriptionDetailSummary
Yes
Full subscription details, or null if none.
enabled
boolean
No
Whether the user account is active.
createdAt
ISO 8601
No
Account creation timestamp.
lastActivityAt
ISO 8601
Yes
Last known activity timestamp.
Example AdminUserDetailResponse {
"id" : "a1b2c3d4-e5f6-7890-abcd-ef1234567890" ,
"username" : "john.doe" ,
"name" : "John Doe" ,
"additionalInfo" : "Cardiology department" ,
"role" : {
"id" : "f47ac10b-58cc-4372-a567-0e02b2c3d479" ,
"name" : "User" ,
"slug" : "user" ,
"type" : "SYSTEM" ,
"assignedAt" : "2026-01-15T10:30:00Z" ,
"assignedBy" : "b2c3d4e5-f6a7-8901-bcde-f12345678901"
},
"subscription" : {
"id" : "c3d4e5f6-a7b8-9012-cdef-123456789012" ,
"planSlug" : "pro" ,
"planName" : "Professional" ,
"status" : "ACTIVE" ,
"currentPeriodStart" : "2026-04-01T00:00:00Z" ,
"currentPeriodEnd" : "2026-05-01T00:00:00Z"
},
"enabled" : true ,
"createdAt" : "2026-01-15T10:30:00Z" ,
"lastActivityAt" : "2026-04-07T14:22:00Z"
}
Status
Description
200 OK
User details retrieved successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
404 Not Found
User not found.
Find User by Username
GET /api/v1/admin/users/by-username/{username}
Requires Authentication - Scopes: admin:users:read
Returns a single user matching the exact username.
Path Parameters
Parameter
Type
Required
Description
username
string
Yes
The exact username to look up.
AdminUserDetailResponse
Returns the same AdminUserDetailResponse schema as Get User by ID .
Status
Description
200 OK
User found successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
404 Not Found
No user found with the given username.
Update User Profile
PATCH /api/v1/admin/users/{userId}
Requires Authentication - Scopes: admin:users:write
Allows administrators to update select user profile fields. Only the provided fields are updated; omitted fields remain unchanged.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
AdminUserUpdateRequest
Field
Type
Required
Description
name
string
No
Updated display name.
additionalInfo
string
No
Updated additional info / admin notes.
enabled
boolean
No
Enable or disable the user account.
AdminUserDetailResponse
Returns the same AdminUserDetailResponse schema as Get User by ID .
Status
Description
200 OK
User profile updated successfully.
400 Bad Request
Invalid request body or admin attempting to disable their own account.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
404 Not Found
User not found.
Assign Role to User
PUT /api/v1/admin/users/{userId}/role
Requires Authentication - Scopes: admin:users:write
Assigns or changes a user's role. The target role's hierarchy order must not exceed the admin's own role weight or the tenant's maximum allowed hierarchy order ceiling.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
AdminUserAssignRoleRequest
Field
Type
Required
Description
roleId
UUID
Yes
ID of the role to assign.
AdminUserDetailResponse
Returns the same AdminUserDetailResponse schema as Get User by ID .
Status
Description
200 OK
Role assigned successfully.
400 Bad Request
Admin attempting to change their own role.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions or target role exceeds allowed hierarchy order.
404 Not Found
User or role not found.
User Subscription Management
Get User Subscription
GET /api/v1/admin/users/{userId}/subscription
Requires Authentication - Scopes: admin:users:read
Returns the subscription details for a specific user, including plan information.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UserSubscriptionResponse
Refer to the primary Subscriptions documentation for the full schema of the response object.
Status
Description
200 OK
User subscription details returned.
204 No Content
User has no subscription.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
Assign User Subscription
PUT /api/v1/admin/users/{userId}/subscription
Requires Authentication - Scopes: admin:users:write
Manually assigns or overrides a user's subscription. This allows administrators to grant a plan (e.g., for internal users, partners, or support cases).
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
AssignSubscriptionRequest
Field
Type
Required
Description
planSlug
string
Yes
Slug of the plan to assign (e.g. pro).
status
string
No
Subscription status. Defaults to ACTIVE. See UserSubscriptionStatus .
expiresAt
datetime
No
Expiration date (maps to currentPeriodEnd). Null means no expiration.
UserSubscriptionResponse
Refer to the primary Subscriptions documentation for the full schema of the response object.
Status
Description
200 OK
Subscription assigned successfully.
400 Bad Request
Invalid plan slug or status value.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
Remove User Subscription
DELETE /api/v1/admin/users/{userId}/subscription
Requires Authentication - Scopes: admin:users:write
Removes a user's subscription record. The user reverts to the standard tenant-default resolution (no subscription layer).
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
Status
Description
204 No Content
Subscription removed successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
404 Not Found
User has no subscription.
User Quota Management
Get User Quotas
GET /api/v1/admin/users/{userId}/quotas
Requires Authentication - Scopes: admin:users:read
Returns quota limits and current usage for a specific user across all services, including whether each quota type has a user-level override.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UserQuotasResponse
Refer to the primary Quotas documentation for the full schema of the response object.
Status
Description
200 OK
User quotas retrieved successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
Update User Quotas
PATCH /api/v1/admin/users/{userId}/quotas
Requires Authentication - Scopes: admin:users:write
Set or update quota overrides for a specific user across all services. Only the provided fields are updated; omitted fields remain unchanged. Send null for a field to reset it to the tenant default.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UpdateQuotasRequest
Refer to the primary Quotas documentation for the full schema of the request object.
UserQuotasResponse
Refer to the primary Quotas documentation for the full schema of the response object.
Status
Description
200 OK
User quotas updated successfully.
400 Bad Request
Invalid request body or field values.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
User Rate Limit Management
Get User Rate Limits
GET /api/v1/admin/users/{userId}/rate-limits
Requires Authentication - Scopes: admin:users:read
Returns the rate limits for a specific user across all services, including whether each rate limit type has a user-level override.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UserRateLimitsResponse
Refer to the primary Rate Limits documentation for the full schema of the response object.
Status
Description
200 OK
User rate limits retrieved successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
Update User Rate Limits
PATCH /api/v1/admin/users/{userId}/rate-limits
Requires Authentication - Scopes: admin:users:write
Set or update rate limit overrides for a specific user across all services. Only the provided fields are updated; omitted fields remain unchanged. Send null for a field to reset it to the tenant default.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UpdateTenantRateLimitDefaultsRequest
Refer to the Admin Rate Limits documentation for the full schema of the request object.
UserRateLimitsResponse
Refer to the primary Rate Limits documentation for the full schema of the response object.
Status
Description
200 OK
User rate limits updated successfully.
400 Bad Request
Invalid request body or field values.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
Reset User Rate Limits
DELETE /api/v1/admin/users/{userId}/rate-limits
Requires Authentication - Scopes: admin:users:write
Removes all user-level rate limit overrides for the specified user. After this operation, the user will use the tenant's default rate limit policy.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
Status
Description
204 No Content
User rate limit overrides removed successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
User Data Retention Management
Get User Retention Policy
GET /api/v1/admin/users/{userId}/retention
Requires Authentication - Scopes: admin:users:read
Returns the retention policy for a specific user across all services, including whether each retention type has a user-level override.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UserRetentionPolicyResponse
Refer to the primary Data Retention documentation for the full schema of the response object.
Status
Description
200 OK
User retention policy retrieved successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:read scope).
Update User Retention Policy
PATCH /api/v1/admin/users/{userId}/retention
Requires Authentication - Scopes: admin:users:write
Partially update retention policy overrides for a specific user across all services. Only the provided fields are updated; omitted fields remain unchanged. Send null for a field to reset it to the tenant default.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
UpdateRetentionPolicyRequest
Refer to the primary Data Retention documentation for the full schema of the request object.
UserRetentionPolicyResponse
Refer to the primary Data Retention documentation for the full schema of the response object.
Status
Description
200 OK
User retention policy updated successfully.
400 Bad Request
Invalid request body or field values.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
Reset User Retention Policy
DELETE /api/v1/admin/users/{userId}/retention
Requires Authentication - Scopes: admin:users:write
Removes all user-level retention policy overrides for the specified user. After this operation, the user will use the tenant's default retention policy.
Path Parameters
Parameter
Type
Required
Description
userId
UUID
Yes
The unique identifier of the user.
Status
Description
204 No Content
User retention policy overrides removed successfully.
401 Unauthorized
Missing or invalid authentication.
403 Forbidden
Insufficient permissions (missing admin:users:write scope).
Data Models
AdminUserResponse
Field
Type
Nullable
Description
id
UUID
No
User unique identifier.
username
string
No
Login username.
name
string
No
Display name.
role
AdminUserRoleSummary
No
Assigned role summary.
subscription
AdminUserSubscriptionSummary
Yes
Active subscription summary, or null if none.
enabled
boolean
No
Whether the user account is active.
createdAt
ISO 8601
No
Account creation timestamp.
lastActivityAt
ISO 8601
Yes
Last known activity timestamp.
AdminUserDetailResponse
Field
Type
Nullable
Description
id
UUID
No
User unique identifier.
username
string
No
Login username.
name
string
No
Display name.
additionalInfo
string
Yes
Admin notes or extra information.
role
AdminUserRoleDetailSummary
No
Assigned role with assignment metadata.
subscription
AdminUserSubscriptionDetailSummary
Yes
Full subscription details, or null if none.
enabled
boolean
No
Whether the user account is active.
createdAt
ISO 8601
No
Account creation timestamp.
lastActivityAt
ISO 8601
Yes
Last known activity timestamp.
AdminUserRoleSummary
Field
Type
Nullable
Description
id
UUID
No
Role identifier.
name
string
No
Role display name.
slug
string
No
URL-friendly role identifier.
type
string
No
Role type: SYSTEM or CUSTOM.
AdminUserRoleDetailSummary
Field
Type
Nullable
Description
id
UUID
No
Role identifier.
name
string
No
Role display name.
slug
string
No
URL-friendly role identifier.
type
string
No
Role type: SYSTEM or CUSTOM.
assignedAt
ISO 8601
No
When the role was assigned.
assignedBy
UUID
No
UUID of the admin who assigned the role.
AdminUserSubscriptionSummary
Field
Type
Nullable
Description
planSlug
string
No
Subscription plan slug.
planName
string
No
Subscription plan display name.
status
string
No
Subscription status. See UserSubscriptionStatus .
currentPeriodEnd
ISO 8601
No
End of current billing period.
AdminUserSubscriptionDetailSummary
Field
Type
Nullable
Description
id
UUID
No
Subscription record identifier.
planSlug
string
No
Subscription plan slug.
planName
string
No
Subscription plan display name.
status
string
No
Subscription status. See UserSubscriptionStatus .
currentPeriodStart
ISO 8601
No
Start of current billing period.
currentPeriodEnd
ISO 8601
No
End of current billing period.
Filters
Field
Type
Nullable
Description
search
string
Yes
Search term applied.
role
string
Yes
Role slug filter applied.
subscriptionPlan
string
Yes
Subscription plan filter applied.
subscriptionStatus
string
Yes
Subscription status filter applied.
createdAfter
ISO 8601
Yes
Created-after filter applied.
createdBefore
ISO 8601
Yes
Created-before filter applied.
SortInfo
Field
Type
Nullable
Description
field
string
No
Sort field name.
direction
string
No
Sort direction (asc or desc).
Enumerations
UserSubscriptionStatus
Value
Description
ACTIVE
The subscription is currently active.
CANCELED
The subscription has been canceled.